Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/vanetza/security/encap_service.hpp

@@ -0,0 +1,54 @@
+#ifndef FD3D1A69_8B8D_4DC1_8975_9FEB7A791B56
+#define FD3D1A69_8B8D_4DC1_8975_9FEB7A791B56
+
+#include <vanetza/security/secured_message.hpp>
+#include <vanetza/security/sign_service.hpp>
+#include <boost/variant/variant.hpp>
+
+namespace vanetza
+{
+namespace security
+{
+
+/**
+ * Input data for encapsulating a packet in a secured message.
+ * 
+ * According to TS 102 723-8 V1.1.1, SN-ENCAP.request offers the very same
+ * functionality as SN-SIGN.request and SN-ENCRYPT.request.
+ * 
+ * Since encryption is not yet implemented, so only SignRequest is included.
+ */
+using EncapRequest = boost::variant<SignRequest>;
+
+/**
+ * Confirmation of the encapsulation process (SN-ENCAP.confirm).
+ * 
+ * TS 102 723-8 V1.1.1 includes only sec_packet but cannot report any errors.
+ * Instead of throwing exceptions, the variant may convey an error code instead
+ * of a SecuredMessage.
+ */
+struct EncapConfirm : public boost::variant<SecuredMessage, SignConfirmError>
+{
+public:
+    static EncapConfirm from(SignConfirm&&);
+
+    const SecuredMessage* secured_message() const;
+    SecuredMessage* secured_message();
+
+private:
+    using variant::variant;
+};
+
+/**
+ * Dispatch an encapsulation request to the responsible service.
+ * 
+ * \param encap_request SN-ENCAP.request data
+ * \param sign_service service handling signing requests
+ * \return SN-ENCAP.confirm
+ */
+EncapConfirm dispatch(EncapRequest&& encap_request, SignService* sign_service);
+
+} // namespace security
+} // namespace vanetza
+
+#endif /* FD3D1A69_8B8D_4DC1_8975_9FEB7A791B56 */